My SMTP server is being probed. It looks like a brute force attach on SASL, where they're going through a password dictionary.
Having seen thousands of these lines in the log files
Sep 18 14:09:52 xxx postfix/smtpd: connect from ca255.calcit.fastwebserver.de[18.104.22.168] Sep 18 14:09:55 xxx postfix/smtpd: warning: ca255.calcit.fastwebserver.de[22.214.171.124]: SASL LOGIN authentication failed: authentication failure Sep 18 14:09:55 xxx postfix/smtpd: lost connection after AUTH from ca255.calcit.fastwebserver.de[126.96.36.199] Sep 18 14:09:55 xxx postfix/smtpd: disconnect from ca255.calcit.fastwebserver.de[188.8.131.52]
I modified my main.cf like this:
inet_interfaces = all smtpd_sasl_auth_enable=yes smtpd_helo_required = yes smtpd_sender_restrictions = reject_unknown_address smtpd_client_restrictions = check_client_access hash:/etc/postfix/maps/access_client, permit_mynetworks, reject smtpd_recipient_restrictions = check_client_access hash:/etc/postfix/maps/access_client, permit_mynetworks, reject_non_fqdn_sender, reject_non_fqdn_recipient, reject_unknown_sender_domain, reject_unknown_recipient_domain, permit_sasl_authenticated, reject_unauth_pipelining, reject_unauth_destination, reject_rbl_client zen.spamhaus.org, reject_rbl_client list.dsbl.org permit broken_sasl_auth_clients = yes
And my /etc/postfix/maps/access_client only has this line:
However after restarting postfix there is still no change in behaviour, I still see the same error, so SASL is still being checked, even though I thought with these settings the client would be rejected based on its IP address before SASL even comes into the game ?
A 2nd question is - I am relaying outgoing mail traffic from one machine to another on the internal network - apart from the 'relayhost' setting on the machine that just relays, can I keep the rest of the postfix settings the same on both ?